Subdomains in the redirect_uri are not properly validated during OAuth authorization flow, making it possible to obtain implicit access tokens using a different subdomain in the request. Clients with the implicit authorization grant type are affected.

Mitigation

OSS users are strongly encouraged to follow one of the mitigations below:

Upgrade to Cloud Foundry v242 [1] or later

For standalone UAA users:

For users using UAA Version 3.0.0 - 3.4.2, please upgrade to UAA Release to v3.7.0[2], v3.4.4[3] or v3.3.0.5[4]

For users using standalone UAA Version 2.X.X, please upgrade to UAA Release to v2.7.4.7 [5]

For users using UAA bosh release, please upgrade to UAA-Release v16 [6] if upgrading to v3.7.0 [2] ,v12.5 [7] if upgrading to v3.4.4[3] or v11.5 [8] if upgrading to v3.3.0.5[4]